\subsection{The Policy Decision Point (PDP)}
\label{sec:PDP}

 The \textsc{Pdp} is a policy engine implemented in Prolog. It computes a decision for access control requests and manages obligations in the policy according to notifications received from the \textsc{Pep} as follows: for an instance creation notification, new Prolog facts representing the instance are inserted into the engine's knowledge base; for a field update notification, old facts specifying the field's value are retracted and replaced by new facts specifying the new value; for a method call notification, new facts corresponding to the call and its parameters' value (which works just as for instance fields) are inserted and the authorization policy is checked. An access control decision is then returned to the \textsc{Pep} and the facts corresponding to the call are retracted from the engine. After each notification, the \textsc{Pdp} also updates the state of obligations. %The access control policy and obligations are managed by the \textsc{Pdp} as follows.
 
\paragraph{Access Control} After a method call is attempted, the call is interpreted by the \textsc{Pep}. An access is granted if it is permitted and not prohibited, i.e. the prohibitions are given an implicit priority over permissions for the resolution of potential conflicts between them. This access control policy evaluation strategy is specified using Prolog rules as follows:

\medskip\noindent
\begin{scriptsize}
\begin{ttfamily}
\begin{tabularx}{\textwidth}{lcl} % 6 columns
\toprule 
allow\_operation(S,A,T) &$\leftarrow$\;& operation(S,A,T), permitted(\_,S,A,T), $\lnot$ prohibited(\_,S,A,T).\\\\

permitted(I,S,A,T)    &$\leftarrow$\;& permission(I,$R_s$,A,$R_t$,C), instance\_of(S,$R_s$), action(A), \\
&& instance\_of(T,$R_t$), hold(S,A,T,C).\\\\

prohibited(I,S,A,T)     &$\leftarrow$\;& prohibition(I,$R_s$,A,$R_t$,C),
instance\_of(S,$R_s$), action(A),\\
&& instance\_of(T,$R_t$), hold(S,A,T,C).\\
\bottomrule
\end{tabularx}
\end{ttfamily}
\end{scriptsize}

\paragraph{Obligations} The \textsc{Pdp} manages the state of obligations by detecting their activation, cancellation, fulfillment and violation. We unify the representation of obligation activation contexts using \textsf{Interval}s: every activation context \textsf{c} is represented using an interval \textsf{[c, !c]}.  %textsf{[Ca,Cd]} (where \textsf{Ca} and \textsf{Cd} are respectively \emph{activation} and \emph{deactivation}): a simple context \textsf{c} is represented as the interval \textsf{[c, !c]}. 




 
\noindent
\begin{table}[t]%
   \begin{sffamily}
      \begin{small}
         \begin{tabularx}{\textwidth}{c|l|l}
            \toprule
             & \textbf{Action} & \textbf{Conditions}\\
             
            \midrule
            1 & \textbf{assert}(obliged(I,S,A,T,[Ca,Cd],Cv,active)) & \begin{tabular}{l}
               action\_obligation(I,R,A,Rt,[Ca,Cd],Cv)\\
               instance\_of(S,R)\\
               instance\_of(T,Rt)\\
               hold(S,A,T,Ca)
            \end{tabular}\\
   			
   			\midrule
            2 & \begin{tabular}{l}
               \textbf{retract}(obliged(I,S,A,T,[Ca,Cd],Cv,active))\\
               \textbf{assert}(obliged(I,S,A,T,[Ca,Cd],Cv,violated))
            \end{tabular} & \begin{tabular}{l}
               obliged(I,S,A,T,[Ca,Cd],Cv,active)\\
               hold(S,A,T,Cv)
            \end{tabular} \\
   
   			\midrule
            3 & \begin{tabular}{l}
               \textbf{retract}(obliged(I,S,A,T,[Ca,Cd],Cv,active))\\
               \textbf{assert}(obliged(I,S,A,T,[Ca,Cd],Cv,fulfilled))
            \end{tabular} & 
            \begin{tabular}{l}
               obliged(I,S,A,T,[Ca,Cd],Cv,active)\\
               operation(S,A,T)
            \end{tabular}\\
     
     		\midrule
            4 & \textbf{retract}(obliged(I,S,A,T,[Ca,Cd],Cv,\_)) & \begin{tabular}{l}
               obliged(I,S,A,T,[Ca,Cd],Cv,\_)\\
               hold(S,A,T,Cd) 
            \end{tabular}\\
   
            \midrule
            5 & \begin{tabular}{l}
               \textbf{retract}(obliged(I,S,Cf,T,[Ca,Cd],Cv,active))\\
               \textbf{assert}(obliged(I,S,Cf,T,[Ca,Cd],Cv,fulfilled))
            \end{tabular} &
            \begin{tabular}{l}
               obliged(I,S,Cf,T,[Ca,Cd],Cv,active)\\
               hold(S,\_,T,Cf) 
            \end{tabular}\\
            \bottomrule
         \end{tabularx}
      \end{small}
   \end{sffamily}
	\bigskip
   \caption{Obligation Management Rules}
   \label{tab:obligations}
   \vspace{-0.8cm}
\end{table}


An obligation is managed as follows: it is instantiated when its activation context holds. It is then fulfilled when its required action (context) is detected, otherwise the obligation is violated if its violation context holds. An obligation is canceled at any time when its deactivation context holds. Table~\ref{tab:obligations} shows the conditions for the detection of the activation, cancellation, fulfillment and violation of obligations and the update actions taken by the \textsc{Pdp} when these conditions are detected. For example, Line 3 specifies that when the state of an obligation is \textsf{active}, its state is updated to \textsf{violated} when its violation context becomes true. State obligations (Line 5) are managed similarly, however their fulfillment is detected when their required context holds.
 

%\vspace{-0.5cm}
\paragraph{Support of Quaternary Predicates} One advantage of using predicate logic to represent the application state is that it simplifies the definition of predicates for the expression of sophisticated state conditions. 
For example, the rules below specify the $contains$ operator for data structures like \textit{ArrayList}s, the less than or equals operator for numbers and the derivation of $violated$ facts from obligation facts respectively. %We have similarly defined other operators for the other supported data structures.

\medskip
\noindent
\begin{scriptsize}
\begin{ttfamily}
\begin{tabularx}{\textwidth}{lcl} % 6 columns
\toprule 
field\_of(Id,Name,$<$=,Val) &$\leftarrow$& 
	field\_of(Id,Name,V), number(V), V =$<$ Val.\\\\

field\_of(Id,Name,includes,Val) &$\leftarrow$&   
	field\_of(Id,Name,V), field\_of(V,e,Val).\\\\
   
violated(Id,S,A,O) &$\leftarrow$& obliged(Id,S,A,O,[C$_a$,C$_d$],C$_v$,violated).\\
\bottomrule
\end{tabularx}
\end{ttfamily}
\end{scriptsize}


